Skip to content

Create service_abuse_google_oauth_with_suspicious_redirect_destinatio…#4107

Merged
hadojae merged 5 commits intomainfrom
hadojae.fn.na.service_abuse_google_oauth_with_suspicious_redirect_destination
Mar 12, 2026
Merged

Create service_abuse_google_oauth_with_suspicious_redirect_destinatio…#4107
hadojae merged 5 commits intomainfrom
hadojae.fn.na.service_abuse_google_oauth_with_suspicious_redirect_destination

Conversation

@hadojae
Copy link
Copy Markdown
Member

@hadojae hadojae commented Mar 3, 2026

…n.yml

Description

Looking at google oauth redirects to commonly abused web services

Associated hunts

@hadojae hadojae requested a review from a team March 3, 2026 21:16
@hadojae hadojae requested a review from a team as a code owner March 3, 2026 21:16
@github-actions github-actions Bot added hunting-required Hunts needed to validate rule efficacy test-rules:excluded:link_analysis Link analysis in rule, excluding from test rules labels Mar 3, 2026
@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Mar 3, 2026

Test Rules Sync - Excluded

This PR contains rules that use ml.link_analysis, which is not supported in the test-rules environment.

The hunting-required label has been applied. These rules will need to be tested through alternative methods.

github-actions Bot added a commit that referenced this pull request Mar 3, 2026
@github-actions
[Shared Samples] [PR #4107] added rule: PR# 4107 - Service abuse: Goo…
a1037d1 
…gle OAuth with suspicious redirect destination
@hadojae hadojae added the review-needed Indicates that a PR is waiting for review label Mar 6, 2026
@hadojae
Copy link
Copy Markdown
Member Author

hadojae commented Mar 6, 2026

looking good, marking ready for review

zoomequipd
zoomequipd requested changes Mar 11, 2026
View reviewed changes
Comment thread detection-rules/service_abuse_google_oauth_with_suspicious_redirect_destination.yml Outdated
github-actions Bot added a commit that referenced this pull request Mar 11, 2026
@github-actions
[Shared Samples] [PR #4107] modified rule: PR# 4107 - Service abuse: …
a8d3f4e 
…Google OAuth with suspicious redirect destination
@github-actions github-actions Bot added the in-test-rules PR is in our testing suite to collect telemetry label Mar 11, 2026
github-actions Bot added a commit that referenced this pull request Mar 11, 2026
@github-actions
[Test Rules] [PR #4107] added rule: Service abuse: Google OAuth with …
c511040 
…suspicious redirect destination
@hadojae hadojae added this pull request to the merge queue Mar 12, 2026
Merged via the queue into main with commit 32170fb Mar 12, 2026
2 checks passed
@hadojae hadojae deleted the hadojae.fn.na.service_abuse_google_oauth_with_suspicious_redirect_destination branch March 12, 2026 18:31
github-actions Bot added a commit that referenced this pull request Mar 12, 2026
@github-actions
[Shared Samples] [PR #4107] Delete detection rule
759a00f
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@zoomequipd zoomequipd zoomequipd approved these changes

Assignees

No one assigned

Labels

hunting-required Hunts needed to validate rule efficacy in-test-rules PR is in our testing suite to collect telemetry review-needed Indicates that a PR is waiting for review test-rules:excluded:link_analysis Link analysis in rule, excluding from test rules

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@hadojae @zoomequipd